[fix][broker] Only send AuthChallenge when client supports it

[michaeljmarshall]

Motivation

While reviewing the ServerCnx, I noticed the broker and client compatibility could have a missing edge case. In this case, the concept of multi-stage authentication was introduced with version 14 of the protocol by #3677. However, we send an AuthChallenge to the client without verifying it has a sufficient protocol version to support such a challenge.

This change is unlikely to fix any real issues because the AuthChallenge was introduced a while ago. However, I think we should add this logic to further support our claim that any version of the client can connect to any version of the broker.

Another reason we might choose not to merge this PR is that it's possible #3677 introduced mutual authentication in the client and the proxy at the same time, so this case isn't possible. My main response is that the protocol is an open spec, so we should use our versioning system to ensure that there isn't even a third party client library that receives protocol messages it is unable to handle.

Modifications

• When an old client tries to connect using an authentication provider that generates an auth challenge, send an AuthenticationError and close the connection for both broker and proxy.
• Only send the AuthChallenge that is triggered by authentication refresh when the client knows how to handle the AuthChallenge protocol message. This is arguably covered by the FeatureFlag, but given what our protocol versioning means, I think we should cover this unlikely edge case.

Verifying this change

Includes a test for ServerCnx and I created an issue for #19624 the proxy.

Does this pull request potentially affect one of the following parts:

This enforces the existing protocol.

Documentation

• doc-not-needed

This is part of the protocol spec.

Matching PR in forked repository

PR in forked repository: michaeljmarshall#32

[michaeljmarshall]

I did not modify the ProxyClientCnx or the DirectProxyHandler logic because in both cases, the proxy only ever sends an AuthChallenge when the broker sends initiates one. Because we send the broker the minimum version of the proxy and the client, the proxy will not get this message unless running with an older version of the broker.

However, I think this is an edge case that this PR should cover, so I'll follow up with another commit tomorrow.

[github-actions]

The pr had no activity for 30 days, mark with Stale label.

[poorbarcode]

Since we will start the RC version of 3.0.0 on 2023-04-11, I will change the label/milestone of PR who have not been merged.

• The PR of type feature is deferred to 3.1.0
• The PR of type fix is deferred to 3.0.1

So drag this PR to 3.0.1

[github-actions]

The pr had no activity for 30 days, mark with Stale label.